CVE-2026-70483 in Open WebUI
Summary
by MITRE • 08/04/2026
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/{id} cancelled a chat's in-flight tasks before checking whether the caller could delete that chat. Any authenticated user who knew another user's chat id could abort that user's running model response, title generation, or tag generation, even though the delete was refused and no chat data was deleted, modified, or disclosed. This issue is fixed in 0.11.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/04/2026
The vulnerability described represents a privilege escalation and denial of service weakness within the Open WebUI platform that existed between versions 0.9.6 and 0.11.0. This flaw specifically affected the DELETE /api/v1/chats/{id} endpoint which handled chat deletion operations. The core technical issue stemmed from an improper order of operations in the authorization and execution logic where the system would first cancel in-flight tasks associated with a chat before verifying whether the authenticated user had the appropriate permissions to delete that particular chat resource. This architectural flaw created a scenario where any authenticated user could potentially disrupt another user's ongoing AI processing activities simply by knowing the target chat identifier.
The operational impact of this vulnerability extends beyond mere inconvenience to constitute a significant security concern within multi-user environments. While the system correctly prevented actual deletion of chat data, the ability to cancel in-flight tasks meant that legitimate users could be subjected to denial of service attacks against their own AI processing workflows. When a user's model response generation, title creation, or tag generation processes were abruptly terminated by an unauthorized actor, it resulted in failed operations and wasted computational resources without any actual data compromise. This behavior aligns with CWE-691, which addresses insufficient control over concurrent execution flows, and represents a classic case of improper privilege management where the system's authorization checks occurred too late in the processing sequence.
The vulnerability demonstrates a clear violation of the principle of least privilege and proper access control implementation within RESTful API endpoints. According to ATT&CK framework category T1499, this issue enables an attacker to perform resource consumption attacks through disruption of services, while also potentially enabling information gathering activities if the cancellation process revealed system state information about ongoing operations. The fact that the vulnerability was resolved in version 0.11.0 indicates that the developers implemented proper authorization checks before task cancellation, ensuring that users could only interfere with their own resources or those for which they possessed explicit deletion permissions.
Mitigation strategies should focus on implementing proper access control verification prior to any destructive operations within API endpoints. The fix required reordering the logical execution flow so that permission validation occurs before task cancellation, preventing unauthorized actors from disrupting legitimate user workflows. Organizations using Open WebUI should immediately upgrade to version 0.11.0 or later to address this vulnerability, while also implementing monitoring for unusual patterns of chat deletion attempts that might indicate exploitation attempts. Additionally, system administrators should consider implementing rate limiting and audit logging around chat deletion operations to detect potential abuse patterns and maintain comprehensive security posture against similar authorization bypass vulnerabilities in other components.